Dickey’s BBQ Locations in California had Highest Risk of Exposure in Recent Data Breach

NOTICE: If you reside in California, used a credit or debit card at Dickey’s Barbecue Pit restaurant between July 2019 and August 2020, and/or have received a NOTICE OF DATA BREACH, contact the Arnold Law Firm at (916) 777-7777.

On October 13, 2020, Dickey’s Barbecue Pit restaurant (commonly known as Dickey’s BBQ), the largest barbecue restaurant chain in the nation, was notified that credit card information for over 3 million customers had been stolen and was offered on a popular card and fraud marketplace known as Joker’s Stash.

The extensive cyberattack is thought to have begun in July 2019, continuing over the past 13-15 months without detection.

Security analysts say the security incident appears to have compromised 156 of Dickey’s 469 restaurant locations, now reportedly across as many as 41 states.  The highest exposure appears to have occurred in California, where the number of Dickey’s restaurants is second only to Texas, the company’s founding location. Surprisingly, only three of 123 locations in Texas were breached.

With a significant number of California locations being affected, the Dickey’s data breach will likely fall under the California Consumer Privacy Act (CCPA) notification requirements.

The CCPA applies to companies that do business in California and collect personal information from California residents. It requires businesses to notify any California resident whose personal information was compromised as a result of a data breach. Any business notifying more than 500 California residents as a result of a single breach must also submit a sample copy of that notification to California’s Attorney General.

The CCPA went into effect on Jan. 1, 2020 and is considered one of the broadest state-level privacy laws in U.S. history. Among the rights the CCPA endows is the consumer’s right to bring an action for statutory damages if a data breach meets certain requirements.

Dickey’s confirmed the breach and claims to have reported the situation to law enforcement and payment card networks. The restaurant has not yet issued a formal data breach notification but stated that they are “currently focused on determining the locations affected and time frames involved.”

The Arnold Law Firm will continue to monitor this data breach and provide updated information as our investigation continues.

If you reside in California, used a credit or debit card at Dickey’s Barbecue Pit restaurant between July 2019 and August 2020, and/or have received a NOTICE OF DATA BREACH, contact the Arnold Law Firm at (916) 777-7777 to discuss your situation and possible legal options.